Bug 1221686

Why would this be a problem of THE INSTALLER (YaST) when you already know that it's a problem of that package?

Traditionally, SUSE Linux has *always* asked for the root password, not of the password of the current user. It has been like that since at least 1999 (probably earlier). This is what SUSE users are used to.

I know that Debian and Ubuntu handle this the exact other way round: They ask for the user's password. IMHO that makes sense since it enables the admin to grant specific permissions to individual users via /etc/sudoers.

In the SUSE configuration, you have to give such a user the root password which leads the whole idea of granting individual users finer-grained permissions ad absurdum; when a user knows the root password, he gets all root privileges anyway if he only logs in as "root" or uses "su".

I know that has been under discussion for a long time, but I don't know the current status; if there was a decision to migrate to the default "sudo" behaviour, i.e. what Debian / Ubuntu are doing. IMHO it would make sense, but it would also be a drastic change of behaviour for long-time SUSE users, probably locking many of them out from "sudo" because they might not get the news.

> % osc maintainer -e sudo
>.
> Defined in package: Base:System/sudo 
>   bugowner of sudo : 
>    otto.hollmann@suse.com
>. 
>   maintainer of sudo : 
>    otto.hollmann@suse.com
>. 
> Defined in project:  Base:System
>   bugowner of sudo : 
>    -
>. 
>   maintainer of sudo : 
>    dmueller@suse.com, meissner@suse.com, ro@suse.com, aj@suse.com, seife@novell.slipkontur.de, trenn@suse.com, werner@suse.com, daniel@molkentin.de, -
>. 
> Defined in project:  Base
>   bugowner of sudo : 
>    -
>. 
>   maintainer of sudo : 
>    adrian.schroeter@suse.com, jblunck@novell.com, rguenther@suse.com

And BTW 'kdesu' is completely independent of this.

> % osc maintainer -e kdesu
>.
>   bugowner of kdesu : 
>    fabian@ritter-vogt.de
>. 
>   maintainer of kdesu : 
>    lbeltrame@kde.org, wbauer1@a1.net, fabian@ritter-vogt.de, alarrosa@suse.com, christophe@krop.fr, -
> 
> Defined in project:  KDE
>   bugowner of kdesu : 
>    -
>. 
>   maintainer of kdesu : 
>    lbeltrame@kde.org, fabian@ritter-vogt.de, wbauer1@a1.net, christophe@krop.fr

(In reply to arctic summer from comment #0)
> These lines are in the sudoers file by default:
> 
> Defaults targetpw
> ALL    ALL=(ALL) ALL

You omitted the comments which would have explained it:

> Defaults targetpw   # ask for the password of the target user i.e. root
> ALL   ALL=(ALL) ALL # WARNING! Only use this together with 'Defaults targetpw'!

Thanks for explaining. I did not expect this to be a default behaviour, so I filed it as a bug. Apologies. I recommend asking for sudo password by default. A message could be included within the installer, thus notifying longtime users of the change.

Over the years (or more likely decades) we learned the hard way that nobody bothers to read documentation anymore these days. That would be something for the release notes that you can view on every workflow step in the installer, but people just don't read that.

And in the case of a major change for something as fundamental as 'sudo', that would be a critical problem, and a lot of users would be furious.

It's still under discussion if there will be any changes (additional options) in installer. There is an idea to display a dialog during installation and ask user if he would like to use root password or sudo group and user password. But at the moment it's only idea.

If you would like to be asked for user password, you have to add your user to "sudo" group and install package "sudo-policy-sudo-auth-self". It will create config file /usr/etc/sudoers.d/50-sudo-auth-self
> Defaults:%sudo !targetpw
> %sudo ALL = (root) ALL

So users that are in group "sudo" will no longer be asked for root password but for their own password.

Also appropriate config files for polkit will be installed with this package.


Do you have any further question or can this bug be closed?

Forget that "during installation" part: The whole system must be deployable via an image, i.e. with zero user interaction. That rules out any crude hacks in the installer, regardless of YaST or Agama; there might not even be one.

IMHO this can be closed. I just wanted to hear your point of view.

I think the Fedora installer has option to enable both root and sudo, mentioning that not setting up root will disable it. This is a good approach in my opinion. Not sure if they still have it in their installer though.
Anyways, I think you guys have made it clear, so yes, this "bug" can be considered resolved.

Thank you for confirmation, closing this bug.